nexoniarz/SchOS
nexoniarz/SchOS
Watch
1
0
Fork
You've already forked SchOS
 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity Actions

unix: a bound socket is a file

Browse source 
Gate 1, item 3, and the last of foundations.md.

bind() creates a T_SOCK node at the path; connect() resolves the path and looks
for the socket bound to **that inode**. Matching on the inode rather than on
the path *string* is the part that matters: the name used to live only in the
socket table, so two spellings of one path missed each other, a relative path
never matched an absolute one, and there was nothing to stat() or unlink().
An inode is the thing a path resolves *to*, so connect() can walk the path
however it likes and arrive at the same socket.

    # ls -l /tmp
    srwxr-xr-x 1 root root 0 2026-09-22 08:04 socktest

The node is a marker, not the binding. It holds no data and the live
association stays in the socket table, so a socket file left by a crash is
what Linux leaves behind -- a dead file that connect() refuses until something
binds again -- and unlink()ing a live socket's path does not disturb anyone
already connected.

EADDRINUSE comes from the *directory* rather than from a scan of the table,
deliberately: a stale socket file has to refuse a rebind for the same reason a
running server's does, or two servers both believe they own it. The creation
lives in sys_bind() and not in unix.c, because that is the layer with both --
kernel/net/unix.c knows about sockets and has no business calling create().

T_SOCK is a compat addition to SchFS by the rule in schfs.h: a driver that does
not know SCHFS_T_SOCK maps it to a zero-length regular file, so nothing goes
stale and nothing becomes unreadable.

cmd/socktest section 15 asserts the plan's own wording -- bind, stat, see an
`s`, unlink -- plus the two a name table could never fail: a second bind to a
live path is refused, and connecting to a path that is a *regular file* is
refused rather than matched by name.

**And the semantics being real broke socktest on its second run**, correctly:
the socket files persisted and every bind() hit EADDRINUSE. Every real server
unlinks before binding; socktest now does too, which is the change the new
behaviour demands rather than a workaround for it.

Chasing that turned up something worse. `socktest` reported rc=1 with every
check passing, and so did every other first-party program:

  - **lib/start.S called main and threw %eax away.** sys_exit() reads the
    status from %rdi and nothing put it there, so every program exited with
    whatever that register happened to hold. Every test suite ends in
    `return failures ? 1 : 0` and none of it reached the shell.
  - **exit(void) passed no status either**, for the same reason: the
    declaration takes no argument, so %rdi was the caller's litter.

`if socktest; then` works now, and a failing command reports 1 -- checked both
ways, because a fix that makes everything return 0 would look identical from
the success side.

Also factored: unlink_path() out of sys_unlink, so a failed bind can take its
own node back out without going through the syscall entry, and create_sock()
as a named door rather than exporting create() with an arbitrary type.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Nexoniarz 2026-09-22 10:06:10 +02:00
commit 3f13989883
15 changed files with 339 additions and 45 deletions
Download patch file Download diff file Expand all files Collapse all files

58
kernel/sys/sys_fs.c
View file

@ -52,6 +52,7 @@ struct linux_stat {
#define LINUX_S_IFCHR 0020000
#define LINUX_S_IFREG 0100000
#define LINUX_S_IFLNK 0120000
#define LINUX_S_IFSOCK 0140000
// Linux's dev_t: 12 bits of major and 8 of minor packed into the low 32, with
// the overflow of each above that. Spelled out in full rather than as
@ -87,6 +88,7 @@ stati_linux(struct inode *ip, struct linux_stat *st)
case T_DIR: type_bits = LINUX_S_IFDIR; perm_bits = 0755; break;
case T_DEV: type_bits = LINUX_S_IFCHR; perm_bits = 0666; break;
case T_SYMLINK: type_bits = LINUX_S_IFLNK; perm_bits = 0777; break;
case T_SOCK: type_bits = LINUX_S_IFSOCK; perm_bits = 0755; break;
default: type_bits = LINUX_S_IFREG; perm_bits = (ip->rwmode & 2) ? 0755 : 0555; break;
}
st->st_mode = type_bits | perm_bits;
@ -812,29 +814,61 @@ bad_link:
// is the standard shape -- and against -1/EPERM every such test took the
// complaining branch. zsh saving its history is one of them, and it went on
// reporting a failure after the history had in fact been written.
addr_t sys_unlink(void)
// A socket node, for bind(2).
//
// create() is static because everything that creates a file is in this file;
// AF_UNIX bind is the one exception, and it gets a named door rather than
// create() being exported -- the difference matters, because `create` with an
// arbitrary type is a much bigger thing to hand out than "make me a socket".
//
// Returns a locked inode, like create() does.
struct inode *
create_sock(char *path)
{
return create(path, T_SOCK, 0, 0);
}
// The body of unlink(2), by path. Factored out so that a failed bind can take
// its own node back out without going through the syscall entry, and so there
// is one implementation of what unlink means rather than two.
//
// The caller brackets this with begin_op()/end_op(), the same as sys_unlink.
int
unlink_path(char *path)
{
struct inode *ip, *dp;
char name[DIRSIZ], *path;
char name[DIRSIZ];
uint off;
int err = EPERM;
if (argstr(0, &path) < 0) return -EFAULT;
begin_op();
if (!(dp = nameiparent(path, name))) { end_op(); return -ENOENT; }
if (!(dp = nameiparent(path, name))) return -ENOENT;
ilock(dp);
// "." and ".." are refused by name, which is what POSIX asks for.
if (namecmp(name, ".") == 0 || namecmp(name, "..") == 0) { err = EINVAL; goto bad_unlink; }
if (!(ip = dirlookup(dp, name, &off))) { err = ENOENT; goto bad_unlink; }
if (namecmp(name, ".") == 0 || namecmp(name, "..") == 0) { err = EINVAL; goto bad; }
if (!(ip = dirlookup(dp, name, &off))) { err = ENOENT; goto bad; }
ilock(ip);
if (ip->nlink < 1) panic("unlink: nlink < 1");
if (ip->type == T_DIR && dirempty(ip) != 1) { iunlockput(ip); err = ENOTEMPTY; goto bad_unlink; }
if (dirunlink(dp, name, off) < 0) { iunlockput(ip); err = EIO; goto bad_unlink; }
if (ip->type == T_DIR && dirempty(ip) != 1) { iunlockput(ip); err = ENOTEMPTY; goto bad; }
if (dirunlink(dp, name, off) < 0) { iunlockput(ip); err = EIO; goto bad; }
if (ip->type == T_DIR) { dp->nlink--; iupdate(dp); }
iunlockput(dp); ip->nlink--; iupdate(ip); iunlockput(ip);
end_op(); return 0;
bad_unlink: iunlockput(dp); end_op(); return -err;
return 0;
bad:
iunlockput(dp);
return -err;
}
addr_t sys_unlink(void)
{
char *path;
int r;
if (argstr(0, &path) < 0) return -EFAULT;
begin_op();
r = unlink_path(path);
end_op();
return r;
}
addr_t sys_exec(void)
{
char *path, *argv[MAXARG], *envp[MAXENV];

64
kernel/sys/sys_net.c
View file

@ -19,6 +19,7 @@
#include "fs.h"
#include "spinlock.h"
#include "sleeplock.h"
#include "stat.h"
#include "file.h"
#include "posix.h"
#include "syscall.h"
@ -241,7 +242,46 @@ SYSCALL_DEFINE(bind)
if ((r = fetch_sun_path(uaddr, ulen, path)) < 0)
return r;
return sockbind(s, path);
// The node lives in the filesystem now, and it is made here rather than in
// sockbind() because this is the layer that has both -- kernel/net/unix.c
// knows about sockets and has no business calling create().
//
// EADDRINUSE comes from the directory, not from a scan of the socket
// table: the name being taken is a property of the filesystem, and a
// socket file left behind by a crashed server has to refuse a rebind for
// the same reason a running one does. Otherwise two servers both believe
// they own it.
{
struct inode *ip;
uint dev;
uint64 ino;
begin_op();
if ((ip = namei(path)) != 0) {
iput(ip);
end_op();
return -EADDRINUSE;
}
if ((ip = create_sock(path)) == 0) {
end_op();
return -ENOENT; // the directory does not exist
}
dev = ip->dev;
ino = ip->inum;
iunlockput(ip);
end_op();
r = sockbind(s, path, dev, ino);
if (r < 0) {
// Take the node back out, so a failed bind leaves nothing behind
// for the next one to trip over.
begin_op();
unlink_path(path);
end_op();
}
return r;
}
}
SYSCALL_DEFINE(listen)
@ -277,7 +317,27 @@ SYSCALL_DEFINE(connect)
if ((r = fetch_sun_path(uaddr, ulen, path)) < 0)
return r;
return sockconnect(s, path);
// Resolve the path here, for the same reason bind() creates here. A path
// that names nothing, or names something that is not a socket, is
// ECONNREFUSED -- which is what Linux says and what a client can act on.
{
struct inode *ip;
uint dev;
uint64 ino;
short type;
if ((ip = namei(path)) == 0)
return -ECONNREFUSED;
ilock(ip);
dev = ip->dev;
ino = ip->inum;
type = ip->type;
iunlockput(ip);
if (type != T_SOCK)
return -ECONNREFUSED;
return sockconnect(s, dev, ino);
}
}
// accept(2) and accept4(2) share everything but the flags word.